EP1832037B1 - Zugriffskontrolllisten für vorlagen - Google Patents

Zugriffskontrolllisten für vorlagen Download PDF

Info

Publication number
EP1832037B1
EP1832037B1 EP05855807.3A EP05855807A EP1832037B1 EP 1832037 B1 EP1832037 B1 EP 1832037B1 EP 05855807 A EP05855807 A EP 05855807A EP 1832037 B1 EP1832037 B1 EP 1832037B1
Authority
EP
European Patent Office
Prior art keywords
acl
checksum
template
received
acls
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Not-in-force
Application number
EP05855807.3A
Other languages
English (en)
French (fr)
Other versions
EP1832037A2 (de
EP1832037A4 (de
Inventor
Craig Lauer
Thierry Paiement
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Cisco Technology Inc
Original Assignee
Cisco Technology Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Cisco Technology Inc filed Critical Cisco Technology Inc
Publication of EP1832037A2 publication Critical patent/EP1832037A2/de
Publication of EP1832037A4 publication Critical patent/EP1832037A4/de
Application granted granted Critical
Publication of EP1832037B1 publication Critical patent/EP1832037B1/de
Not-in-force legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • An Access Control List is a sequential collection of permit/deny conditions (also referred to as a rule set) that apply to IP addresses and associated actions.
  • ACLs are generally used to provide security filtering, though they may also be used to provide a generic packet classification facility.
  • ACLs filter network traffic by controlling whether routed packets are forwarded or blocked at the router's interfaces. When a packet arrives on a router interface, software tests the packet against the conditions in the ACL to determine if there is a match between the IP header contents and the ACL entries. If there is a match, the actions associated with the first match will be applied.
  • An ACL can be attached to packets received on an interface, and to packets outgoing on an interface. One important attribute of ACLs is that they are searched sequentially, so the rule that is applied is the first matching rule, not the rule that provides the best match.
  • Packet filtering using ACLs controls packet transmission throughout the network. This control can allow the network administrator to secure the network by limiting unnecessary or unwanted network traffic, and by restricting network use by certain users or devices.
  • Security ACLs are used to permit or deny specified packets from crossing specified interfaces. They can be used to control the transmission of packets on an interface, to control virtual terminal line access, or to restrict the contents of routing updates.
  • ACLs can also be used as a means of classifying packets for various route-maps, and for performing Quality of Service (QoS) checks.
  • QoS Quality of Service
  • TurboACL There are different types of ACLs.
  • One type of ACL is known as "TurboACL" in which a collection of ACLs is processed into a data structure.
  • TurboACL has two basic parts. The first part is a process that takes the internal access control lists and builds a set of data tables. The second part is a run time operation that uses the packet header values and the data tables determined in the first part to lookup which entries in the ACL match this packet.
  • the run time operation for TurboACL is very fast and is deterministic in that regardless of how many ACL entries there are, the same amount of processing power is consumed. This permits for improved processing time of ACLs in certain scenarios.
  • MiniACL Another type of ACL is known as "MiniACL" in which an individual ACL is processed into a data structure.
  • the MiniACL process takes the internal access control lists and builds a set of data tables.
  • a run time operation uses the packet header values and the data tables to lookup which entries in the ACL match this packet.
  • the run time operation is very fast and is deterministic in that no matter how many ACL entries there are, the same amount of processing power is consumed. This also permits for improved processing time of ACLs in certain environments.
  • MiniACLs require less memory than TurboACLs, but can only support a limited number of rules per ACL.
  • US Patent Application Publication No. 2002/166052 discloses a system in which an authorization handle is supported for each access policy determination that is likely to be repeated.
  • an authorization handle may be assigned to access check results associated with the same discretionary access control list and the same client context. This likelihood may be determined based upon pre-set criteria for the application or service, based on usage history and the like.
  • US Patent Application Publication No. 2004/260818 discloses a system for providing compliance verification information in the field of network security.
  • US Patent No. 6,651,096 discloses an apparatus for efficiently organizing, storing and evaluating ACLs for use by an intermediate network device of a computer network.
  • the intermediate network device includes an ACL converter which, in turn, includes a boolean transformation engine that is operatively coupled to a boolean manipulation engine.
  • the boolean transformation engine is configured to access the ACLs in first format and to translate them into a first boolean representation, such as binary decision diagram (BDD) format.
  • the boolean manipulation engine is configured to perform one or more operations on the ACLs specified for a given interface, including a merge operation, so as to generate a single, unified ACL for the given interface.
  • An article entitled " Discretionary access controls in a high-performance object management system" by U. Kelter published in the Proceedings of the Symposium on Research in Security and Privacy, Oakland, May 20-22, 1991, vol. Sump. 12, 20 May 1991, pages 288-299, XP010024230 discloses a method for efficiently implementing ACLs in main memory object-oriented database systems, in which the ACLs are not stored directly, but by ACL numbers.
  • a drawback associated with conventional TurboACLs is that they are slow to compile and require large amounts of memory.
  • a drawback associated with MiniACLs is that they also require a large amount of memory and are limited to only eight rules per ACL.
  • Embodiments of the invention significantly overcome such drawbacks and provide mechanisms and techniques that provide template ACLs.
  • a first ACL is obtained.
  • the first ACL has a first rule set, and the first rule set includes a peer Internet Protocol (IP) address.
  • IP Internet Protocol
  • This peer IP address is typically the IP address of the system which is the source or destination of the packet.
  • the first rule set is copied into the template ACL, resulting in a template ACL rule set.
  • the occurrence of a peer's IP address within the template ACL rule set is determined and replaced with an indicator indicating that the peer's IP address is used in place of the indicator when the ACL is evaluated.
  • the indicator can be thought of a sort of "wildcard”.
  • a method wherein template ACLs are processed includes receiving an ACL.
  • a checksum is calculated for the received ACL.
  • a data structure containing previously processed ACL checksums is searched for a checksum which matches the checksum of the received ACL.
  • the checksum of the received ACL does not match a checksum in the data structure, then the checksum of the received ACL is added to the data structure of ACL checksums.
  • a determination is made regarding whether a template for the ACL exists. When a template for the ACL does not exist then a new template is produced and the received ACL is pointed to the template.
  • the medium includes instructions for obtaining a first ACL.
  • the first ACL has a first rule set, and the first rule set includes a peer Internet Protocol (IP) address.
  • IP Internet Protocol
  • This peer IP address is typically the IP address of the system which may be the source or destination of the packet.
  • the medium also includes instructions for copying the first rule set into the template ACL, resulting in a template ACL rule set.
  • the medium further includes instructions for determining occurrences of a peer IP address within the template ACL, and for replacing the occurrences of the peer IP address with an indicator indicating that the peer's IP address is used in place of the indicator when the ACL is evaluated.
  • Still other embodiments include a computer readable medium having computer readable code thereon for providing and processing template ACLs.
  • the medium includes instructions for receiving an ACL and instructions for determining a checksum for the received ACL.
  • the medium also includes instructions for checking a data structure of ACL checksums for a checksum which matches the checksum of the received ACL.
  • the medium additionally includes instructions such that when the checksum of the received ACL does not match a checksum in the data structure, then the checksum of the received ACL is added to the data structure of ACL checksums, and when the checksum of the received ACL does match a checksum in the data structure, then a determination is made whether a template for the ACL exists.
  • the medium further includes instructions for producing a new template when a template for the ACL does not exist as well as instructions for pointing the received ACL to the template.
  • the computerized device includes a memory system, a processor, communications interface in an interconnection mechanism connecting these components.
  • the memory system is encoded with a process that provides template ACLs as explained herein that when performed (e.g. when executing) on the processor, operates as explained herein within the computerized device to perform all of the method embodiments and operations explained herein as embodiments of the invention.
  • any computerized device that performs or is programmed to perform up processing explained herein is an embodiment of the invention.
  • a computer program product is one embodiment that has a computer-readable medium including computer program logic encoded thereon that when performed in a computerized device provides associated operations providing template ACLs as explained herein.
  • the computer program logic when executed on at least one processor with a computing system, causes the processor to perform the operations (e.g., the methods) indicated herein as embodiments of the invention.
  • Such arrangements of the invention are typically provided as software, code and/or other data structures arranged or encoded on a computer readable medium such as an optical medium (e.g., CD-ROM), floppy or hard disk or other a medium such as firmware or microcode in one or more ROM or RAM or PROM chips or as an Application Specific Integrated Circuit (ASIC) or as downloadable software images in one or more modules, shared libraries, etc.
  • the software or firmware or other such configurations can be installed onto a computerized device to cause one or more processors in the computerized device to perform the techniques explained herein as embodiments of the invention.
  • Software processes that operate in a collection of computerized devices, such as in a group of data communications devices or other entities can also provide the system of the invention.
  • the system of the invention can be distributed between many software processes on several data communications devices, or all processes could run on a small set of dedicated computers, or on one computer alone.
  • Template ACLs permit the repeated use of a single ACL with minor changes for each additional user.
  • An ACL includes a rule set which indicates permit/deny conditions that apply to IP addresses and associated actions.
  • An example ACL is shown below and includes a rule set having a header and 13 rules.
  • Each rule is applied sequentially to the incoming or outgoing packet header to determine if there is a match. When a match occurs, then the appropriate action is taken. For example, when the rule set is being processed and rule "deny ip host 44.33.66.36 host 1.1.1.1" is encountered wherein a packet from a source having an IP address of 44.33.66.36 and destined for IP address 1.1.1.1, then the packet will be denied and node 1.1.1.1 will not receive the packet from source 44.33.66.36.
  • the node IP address is referred to as the peer IP address.
  • the first and second ACLs can be recognized as 'similar', and a new Template ACL can be provided which works for both rule sets.
  • the difference between these two rule sets is that the first rule set has a peer IP address of 1.1.1.1 while the second rule set has a peer IP address of 13.1.1.2.
  • the peer IP address for each rule set is replaced with an indicator (e.g., in this instance ⁇ MAGICIP>), as shown in the template ACL below
  • Each indicator is translated into the IP address the user IP must match.
  • the mask bits will be 0's, indicating a don't-care condition, and the key bits will be 0.
  • the key bit is set to 1, and the mask bit is also set to 1, indicating that the key bit in the input packet must be on as well.
  • IP address For example, two IP associations are provided below for illustrative purposes.
  • the interface knows which user a packet is coming from/going to, so the interface can obtain the user IP address for the comparison from the IP address table.
  • Template ACLs accommodate minimally changing ACLs at little cost, and minimize the memory and CPU consumption while simultaneously supporting several ACLs; each having rule sets containing any number of rules.
  • FIG. 1-3 Flow charts of the presently disclosed methods are depicted in Figures 1-3 .
  • the rectangular elements are herein denoted “processing blocks” and represent computer software instructions or groups of instructions.
  • the diamond shaped elements are herein denoted “decision blocks,” represent computer software instructions, or groups of instructions which affect the execution of the computer software instructions represented by the processing blocks.
  • the processing and decision blocks represent steps performed by functionally equivalent circuits such as a digital signal processor circuit or an application specific integrated circuit (ASIC).
  • ASIC application specific integrated circuit
  • the flow diagrams do not depict the syntax of any particular programming language. Rather, the flow diagrams illustrate the functional information one of ordinary skill in the art requires to fabricate circuits or to generate computer software to perform the processing required in accordance with the present invention. It should be noted that many routine program elements, such as initialization of loops and variables and the use of temporary variables are not shown. Thus, unless otherwise stated the steps described below are unordered meaning that, when possible, the steps can be performed in any convenient or desirable order.
  • the method 10 begins with processing block 12 wherein a first ACL is received.
  • the first ACL includes a first rule set, the first rule set including a peer Internet Protocol (IP) address.
  • IP Internet Protocol
  • processing block 14 the first rule set is copied into the template ACL.
  • processing block 16 a determination is made regarding occurrences of peer IP addresses in the rule set of the template ACL.
  • occurrences of a peer's IP address within the rule set of the template ACL are replaced with an indicator (e.g. ⁇ MAGICIP>) indicating that the peer's IP address is used in place of the indicator when the ACL is evaluated.
  • an indicator e.g. ⁇ MAGICIP>
  • ACLs Access Control Lists
  • a checksum is determined for the received ACL. This is done by walking through the ACL contents, building a checksum from the rules, while ignoring the peer IP addresses that match the user the ACL is applied to.
  • the checksum comprises a Method Digest Algorithm 5 (MD5) digest value (128 bits). The use of a 128 bit checksum greatly diminishes the likelihood of a scenario wherein two different rule sets have the same checksum.
  • processing block 56 a data structure of ACL checksums is searched for a checksum which matches the checksum of the received ACL.
  • decision block 58 a determination is made whether a match was found. When a match is not found, processing continues with processing block 60. When a match is found, processing continues with decision block 64.
  • the ACL is further processed, such as being compiled by a TurboACL or MiniACL process.
  • decision block 64 when the checksum of the received ACL does match a checksum in the data structure, then a determination is made regarding whether a template for the ACL exists. When a template for the ACL does not exist, then processing continues at processing block 66. When a template does exist, then processing continues at processing block 68.
  • processing block 66 when a template for the ACL does not exist then a new template is produced and the matching ACL is attached to the template.
  • processing block 68 the received ACL is pointed to the template equivalent.
  • FIG. 3 another embodiment of a method 100 of building and processing template Access Control Lists (ACLs) is shown.
  • the method 100 begins with processing block 102 wherein an ACL is received.
  • a checksum is determined for the received ACL. This is done by walking through the ACL contents, building a checksum from the rules, while ignoring the peer IP addresses that match the user the ACL is applied to.
  • the checksum comprises a 32-bit value ( Figure 3 ), which requires less processing and less space than the 128-bit checksum used in the method described above and shown in Figure 2 .
  • the use of a 32-bit checksum however does not avoid a scenario wherein two different rule sets have the same checksum. Additional processing is thus required to ensure that the same checksum did not result from two different rule sets.
  • processing block 106 a data structure of ACL checksums is searched for a checksum which matches the checksum of the received ACL.
  • decision block 108 a determination is made whether a match was found. When a match is not found, processing continues with decision block 110. When a match is found, processing continues with processing block 114.
  • processing block 110 when the checksum of the received ACL does not match a checksum in the data structure, then the checksum of the received ACL is added to the data structure of ACL checksums.
  • the ACL is further processed, such as being compiled by a TurboACL or MiniACL process.
  • a particular method for producing a template ACL has been described above and shown in Figure 1 .
  • decision block 114 when the determination made in decision block 108 is that a matching checksum has been found, then a determination is made regarding whether all the rules in the rule set of the present ACL match all the rules in the rule set having a matching checksum, ignoring all occurances of the peer IP addresses that match the user the ACL is applied to. This rule set matching is done to verify that even though two ACLs may have the same checksum, it is possible that the rule sets are in fact different.
  • decision block 120 When the determination is that the ACL does match the ACL with the same checksum, processing continues at decision block 120.
  • decision block 116 When the determination is that the ACL does not match the ACL with the same checksum, processing continues at decision block 116.
  • decision block 116 a determination is made regarding whether all the ACLs which have the same checksum as the received ACL have been checked. When the determination is that there are other ACLs that have the same checksum as the received ACL then processing continues at processing block 118. When the determination is that there are no other ACLs with the same checksum as the received ACL that have not been checked yet, then processing continues at decision block 126. or when all the ACLs with a matching checksum have been compared to the received ACL,
  • processing block 118 the next ACL with a matching checksum as the received ACL is obtained, and processing continues at decision block 114.
  • This loop comprising decision block 114, decision block 116 and processing block 118 may be performed multiple times depending upon the number of ACLs that have a matching checksum with the received ACL.
  • decision block 120 when the checksum of the received ACL does match a checksum in the data structure, then a determination is made regarding whether a template for the ACL exists. When a template for the ACL does not exist, then processing continues at processing block 122. When a template does exist, then processing continues at processing block 124.
  • processing block 122 when a template for the ACL does not exist then a new template is produced and the matching ACL is attached to the template.
  • processing block 124 the received ACL is pointed to the template equivalent.
  • processing block 126 the received ACL is added to the list of unique ACLs that match the checksum, and processing continues to processing block 112.
  • Figure 4 illustrates example architectures of a computer system that is configured as a host computer system 240.
  • the computer system 240 may be any type of computerized system such as a personal computer, workstation, portable computing device, mainframe, server or the like.
  • the system includes an interconnection mechanism 211 that couples a memory system 212, a processor 213, and a communications interface 214.
  • the communications interface 214 allows the computer system 240 to communicate with external devices or systems.
  • the memory system 212 may be any type of computer readable medium that is encoded with an application 255-A that represents software code such as data and/or logic instructions (e.g., stored in the memory or on another computer readable medium such as a disk) that embody the processing functionality of embodiments of the invention for the agent 255 as explained above.
  • the processor 213 can access the memory system 212 via the interconnection mechanism 211 in order to launch, run, execute, interpret or otherwise perform the logic instructions of the applications 255-A for the host in order to produce a corresponding process 255-B.
  • the process 255-B represents one or more portions of the application 255-A performing within or upon the processor 213 in the computer system.
  • embodiments of the invention include the applications (i.e., the un-executed or non-performing logic instructions and/or data) encoded within a computer readable medium such as a floppy disk, hard disk or in an optical medium, or in a memory type system such as in firmware, read only memory (ROM), or, as in this example, as executable code within the memory system 212 (e.g., within random access memory or RAM).
  • a computer readable medium such as a floppy disk, hard disk or in an optical medium
  • a memory type system such as in firmware, read only memory (ROM), or, as in this example, as executable code within the memory system 212 (e.g., within random access memory or RAM).
  • ROM read only memory
  • RAM random access memory
  • ACLs used for performing other functions such as Quality of Service (QoS), where selected packet types are handled differently within the network to provide a differentiated level of reliability, cost, etc.
  • QoS Quality of Service
  • TCAM Ternary Content Addressable Memory
  • a computer usable medium can include a readable memory device, such as a hard drive device, a CD-ROM, a DVD-ROM, or a computer diskette, having computer readable program code segments stored thereon.
  • the computer readable medium can also include a communications link, either optical, wired, or wireless, having program code segments carried thereon as digital or analog signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Claims (7)

  1. Verfahren zum Verarbeiten von Vorlagen-Zugriffssteuerungslisten (Access Control Lists, ACLs) in einer Netzwerkvorrichtung, wobei das Verfahren Folgendes umfasst:
    Empfangen (52) einer ACL;
    Bestimmen (54) einer Prüfsumme für die empfangene ACL;
    Prüfen (56) einer Datenstruktur von ACL-Prüfsummen, die in einem Speicher der Netzwerkvorrichtung gespeichert sind, auf eine Prüfsumme, die mit der Prüfsumme der empfangenen ACL übereinstimmt;
    wenn die Prüfsumme der empfangenen ACL nicht mit einer Prüfsumme in der genannten Datenstruktur übereinstimmt (58), Hinzufügen (60) der Prüfsumme der empfangenen ACL zu der Datenstruktur der ACL-Prüfsummen undKompilieren der empfangenen ACL und Speichern der kompilierten ACL in dem Speicher;
    wenn die Prüfsumme der empfangenen ACL mit einer Prüfsumme in der genannten Datenstruktur übereinstimmt (58),
    Bestimmen (64), ob eine Vorlage für die ACL in dem Speicher existiert, und
    i) wenn eine Vorlage für die ACL in dem Speicher existiert, dann Richten (68) der empfangenen ACL auf die existierende Vorlage; und
    ii) wenn eine Vorlage für die ACL nicht in dem Speicher existiert, Erzeugen (66) einer neuen Vorlage, Anhängen der empfangenen ACL an die neue Vorlage, Speichern der neuen Vorlage in dem Speicher und Richten (68) der empfangenen ACL auf die neue Vorlage.
  2. Verfahren nach Anspruch 1, wobei das genannte Bestimmen einer Prüfsumme das Bestimmen einer 32-Bit- oder einer 128-Bit-Prüfsumme umfasst.
  3. Verfahren nach Anspruch 1, wobei die genannte Datenstruktur einen Rot-Schwarz-Baum umfasst.
  4. Verfahren nach Anspruch 1, wobei das genannte Bestimmen, ob eine Vorlage für die ACL in dem Speicher existiert, Folgendes umfasst:
    Vergleichen (114) der ACL mit anderen ACLs, die dieselbe Prüfsumme haben, und Bestimmen, ob die genannte ACL mit einer beliebigen der genannten anderen ACLs übereinstimmt, die dieselbe Prüfsumme haben;
    wenn die genannte ACL keiner der anderen ACLs mit derselben Prüfsumme entspricht, Hinzufügen (126) der Prüfsumme der empfangenen ACL zu der Datenstruktur der ACL-Prüfsummen und Kompilieren (112) der empfangenen ACL; und
    wenn die genannte ACL mit einer anderen der genannten ACLs übereinstimmt, die die gleiche Prüfsumme haben, Feststellen, dass die genannte ACL bereits gefunden wurde.
  5. Verfahren nach Anspruch 1, wobei die empfangene ACL eine erste Regel aufweist, die ein oder mehrere Vorkommen einer Peer-Internetprotokoll-, IP, Adresse umfasst, undwobei das Bestimmen einer Prüfsumme für die empfangene ACL das Ignorieren des Vorkommens der Peer-IP-Adresse in der ACL umfasst.
  6. Netzwerkvorrichtung, die Folgendes umfasst:
    einen Speicher (212);
    einen Prozessor (213), der mit dem Speicher (212) gekoppelt ist;
    wobei in dem Speicher computerlesbare Anweisungen (255-A) gespeichert sind, die, wenn sie auf dem Prozessor (213) ausgeführt werden, bewirken, dass der Prozessor (213) ein Verfahren nach einem der vorhergehenden Ansprüche ausführt.
  7. Computerlesbares Medium mit computerlesbaren Anweisungen darauf zum Erzeugen einer Vorlagen-Zugriffssteuerungsliste, ACL, wobei die computerlesbaren Anweisungen betriebsbereit sind, wenn sie von einer Netzwerkvorrichtung ausgeführt werden, um die Netzwerkvorrichtung zu veranlassen, ein Verfahren nach einem der Ansprüche 1 bis 5 durchzuführen.
EP05855807.3A 2004-12-30 2005-12-29 Zugriffskontrolllisten für vorlagen Not-in-force EP1832037B1 (de)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US11/026,454 US7647643B2 (en) 2004-12-30 2004-12-30 Template access control lists
PCT/US2005/047308 WO2006074018A2 (en) 2004-12-30 2005-12-29 Template access control lists

Publications (3)

Publication Number Publication Date
EP1832037A2 EP1832037A2 (de) 2007-09-12
EP1832037A4 EP1832037A4 (de) 2011-06-01
EP1832037B1 true EP1832037B1 (de) 2018-04-11

Family

ID=36648054

Family Applications (1)

Application Number Title Priority Date Filing Date
EP05855807.3A Not-in-force EP1832037B1 (de) 2004-12-30 2005-12-29 Zugriffskontrolllisten für vorlagen

Country Status (3)

Country Link
US (1) US7647643B2 (de)
EP (1) EP1832037B1 (de)
WO (1) WO2006074018A2 (de)

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8544058B2 (en) * 2005-12-29 2013-09-24 Nextlabs, Inc. Techniques of transforming policies to enforce control in an information management system
US8700771B1 (en) * 2006-06-26 2014-04-15 Cisco Technology, Inc. System and method for caching access rights
US11469789B2 (en) 2008-07-09 2022-10-11 Secureall Corporation Methods and systems for comprehensive security-lockdown
US10447334B2 (en) 2008-07-09 2019-10-15 Secureall Corporation Methods and systems for comprehensive security-lockdown
US10128893B2 (en) 2008-07-09 2018-11-13 Secureall Corporation Method and system for planar, multi-function, multi-power sourced, long battery life radio communication appliance
US20130247153A1 (en) * 2012-03-16 2013-09-19 Secureall Corporation Electronic apparatuses and methods for access control and for data integrity verification
US8739269B2 (en) 2008-08-07 2014-05-27 At&T Intellectual Property I, L.P. Method and apparatus for providing security in an intranet network
US8874526B2 (en) 2010-03-31 2014-10-28 Cloudera, Inc. Dynamically processing an event using an extensible data model
US9082127B2 (en) 2010-03-31 2015-07-14 Cloudera, Inc. Collecting and aggregating datasets for analysis
US9317572B2 (en) 2010-03-31 2016-04-19 Cloudera, Inc. Configuring a system to collect and aggregate datasets
US9081888B2 (en) 2010-03-31 2015-07-14 Cloudera, Inc. Collecting and aggregating log data with fault tolerance
US8667267B1 (en) * 2011-01-31 2014-03-04 Gazzang, Inc. System and method for communicating with a key management system
US8880592B2 (en) 2011-03-31 2014-11-04 Cloudera, Inc. User interface implementation for partial display update
US9128949B2 (en) 2012-01-18 2015-09-08 Cloudera, Inc. Memory allocation buffer for reduction of heap fragmentation
US9172608B2 (en) 2012-02-07 2015-10-27 Cloudera, Inc. Centralized configuration and monitoring of a distributed computing cluster
US9405692B2 (en) 2012-03-21 2016-08-02 Cloudera, Inc. Data processing performance enhancement in a distributed file system
US9338008B1 (en) 2012-04-02 2016-05-10 Cloudera, Inc. System and method for secure release of secret information over a network
US9842126B2 (en) 2012-04-20 2017-12-12 Cloudera, Inc. Automatic repair of corrupt HBases
US9753954B2 (en) 2012-09-14 2017-09-05 Cloudera, Inc. Data node fencing in a distributed file system
US9342557B2 (en) 2013-03-13 2016-05-17 Cloudera, Inc. Low latency query engine for Apache Hadoop
US9477731B2 (en) 2013-10-01 2016-10-25 Cloudera, Inc. Background format optimization for enhanced SQL-like queries in Hadoop
US9934382B2 (en) 2013-10-28 2018-04-03 Cloudera, Inc. Virtual machine image encryption
US9690671B2 (en) 2013-11-01 2017-06-27 Cloudera, Inc. Manifest-based snapshots in distributed computing environments
US10171635B2 (en) 2013-12-04 2019-01-01 Cloudera, Inc. Ensuring properly ordered events in a distributed computing environment
US9485257B2 (en) * 2014-05-22 2016-11-01 International Business Machines Corporation Atomically updating ternary content addressable memory-based access control lists
US9497119B2 (en) 2014-05-22 2016-11-15 International Business Machines Corporation Supporting access control list rules that apply to TCP segments belonging to ‘established’ connection
US9749328B2 (en) 2014-05-22 2017-08-29 International Business Machines Corporation Access control list-based port mirroring techniques
US9722931B2 (en) 2014-06-05 2017-08-01 International Business Machines Corporation Unified framework for isolating multicast and broadcast frames to a traffic class separate from a traffic class used for unicast frames
US9516028B1 (en) * 2014-08-06 2016-12-06 Amazon Technologies, Inc. Hierarchical policy-based shared resource access control
US9747333B2 (en) 2014-10-08 2017-08-29 Cloudera, Inc. Querying operating system state on multiple machines declaratively
US10120904B2 (en) 2014-12-31 2018-11-06 Cloudera, Inc. Resource management in a distributed computing environment
US10148662B1 (en) * 2015-01-21 2018-12-04 EMC IP Holding Company LLC De-duplication of access control lists
CN106612211B (zh) * 2015-10-23 2020-02-21 华为技术有限公司 VxLAN中的路径探测方法，控制器和网络设备
US9912639B1 (en) * 2015-12-28 2018-03-06 Juniper Networks, Inc. Verifying firewall filter entries using rules associated with an access control list (ACL) template
CN110413215B (zh) * 2018-04-28 2023-11-07 伊姆西Ip控股有限责任公司 用于获取访问权限的方法、设备和计算机程序产品
US11483313B2 (en) * 2018-06-28 2022-10-25 Intel Corporation Technologies for updating an access control list table without causing disruption
CN109672665B (zh) * 2018-11-14 2021-10-15 北京奇艺世纪科技有限公司 一种访问控制方法、装置、系统及计算机可读存储介质

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6651096B1 (en) 1999-04-20 2003-11-18 Cisco Technology, Inc. Method and apparatus for organizing, storing and evaluating access control lists
US6289460B1 (en) * 1999-09-13 2001-09-11 Astus Corporation Document management system
US7016966B1 (en) 2000-05-09 2006-03-21 Sun Microsystems, Inc. Generating results gates in a distributed computing environment
US7010573B1 (en) 2000-05-09 2006-03-07 Sun Microsystems, Inc. Message gates using a shared transport in a distributed computing environment
US7051078B1 (en) 2000-07-10 2006-05-23 Cisco Technology, Inc. Hierarchical associative memory-based classification system
US7096367B2 (en) 2001-05-04 2006-08-22 Microsoft Corporation System and methods for caching in connection with authorization in a computer system
US7245623B1 (en) * 2002-01-08 2007-07-17 Cisco Technology, Inc. System and method using hierarchical parallel banks of associative memories
US20040260818A1 (en) * 2003-06-23 2004-12-23 Valois Denis Gabriel Network security verification system and method
US7613701B2 (en) * 2004-12-22 2009-11-03 International Business Machines Corporation Matching of complex nested objects by multilevel hashing

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
EP1832037A2 (de) 2007-09-12
WO2006074018A3 (en) 2007-12-21
US7647643B2 (en) 2010-01-12
WO2006074018A2 (en) 2006-07-13
EP1832037A4 (de) 2011-06-01
US20060156018A1 (en) 2006-07-13

Similar Documents

Publication Publication Date Title
EP1832037B1 (de) Zugriffskontrolllisten für vorlagen
US10834085B2 (en) Method and apparatus for speeding up ACL rule lookups that include TCP/UDP port ranges in the rules
JP4598127B2 (ja) ステートフルなパケット内容マッチング機構
EP1897324B1 (de) Inspektionsmechanismus für mehrstrukturpaketinhalt mit eigenschaftswerten
US9270704B2 (en) Modeling network devices for behavior analysis
Liu et al. A fast string-matching algorithm for network processor-based intrusion detection system
US7467406B2 (en) Embedded data set processing
US7389532B2 (en) Method for indexing a plurality of policy filters
US20070271613A1 (en) Method and Apparatus for Heuristic/Deterministic Finite Automata
WO2005060525A2 (en) A network security planning architecture
US8543528B2 (en) Exploitation of transition rule sharing based on short state tags to improve the storage efficiency
Fiessler et al. HyPaFilter: A versatile hybrid FPGA packet filter
GB2420043A (en) Packet forwarding rules engine with access control list table and extension rule table
US11818099B2 (en) Efficient matching of feature-rich security policy with dynamic content using user group matching
US10944724B2 (en) Accelerating computer network policy search
US8122189B1 (en) Methods for logically combining range representation values in a content addressable memory
CN112437096B (zh) 加速策略查找方法及系统
US20200145379A1 (en) Efficient matching of feature-rich security policy with dynamic content using incremental precondition changes
US10965647B2 (en) Efficient matching of feature-rich security policy with dynamic content
Brown Formal network behaviour analysis using model checking
Davies et al. Eliminating dependencies in linear ACLs
Tongaonkar Efficient techniques for fast packet classification
Tripp An Instrusion Detection System for Gigabit Networks

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20070425

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA HR MK YU

R17D Deferred search report published (corrected)

Effective date: 20071221

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 7/04 20060101AFI20080115BHEP

DAX Request for extension of the european patent (deleted)
RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 7/04 20060101AFI20080229BHEP

Ipc: H04L 9/32 20060101ALI20080229BHEP

Ipc: G06K 9/00 20060101ALI20080229BHEP

Ipc: G06F 17/30 20060101ALI20080229BHEP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602005053815

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0009000000

Ipc: H04L0029060000

A4 Supplementary search report drawn up and despatched

Effective date: 20110503

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 29/06 20060101AFI20110427BHEP

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

INTG Intention to grant announced

Effective date: 20171107

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LI LT LU LV MC NL PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 989159

Country of ref document: AT

Kind code of ref document: T

Effective date: 20180415

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602005053815

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20180411

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180711

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180712

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 989159

Country of ref document: AT

Kind code of ref document: T

Effective date: 20180411

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180813

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602005053815

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

26N No opposition filed

Effective date: 20190114

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181229

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20181231

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181229

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181231

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20181231

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20191226

Year of fee payment: 15

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20200102

Year of fee payment: 15

Ref country code: DE

Payment date: 20191231

Year of fee payment: 15

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20051229

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180411

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20180811

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602005053815

Country of ref document: DE

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20201229

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20201231

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210701

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20201229

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230525